automating document control processes to comply with fda and iso requirements: increase efficiency,...

8/8/2019 Automating Document Control Processes to Comply with FDA and ISO Requirements: Increase Efficiency, Ensure C

1/9

White Paper:Automating Document ControProcesses to Comply with FDAand ISO Requirements:

Increase Efficiency, EnsureCompliance and ImproveProfitability

If you like our white papers, youll love our products.

See what our customers say about MasterControl products.

Creating a Paperless Process Using MasterControl
http://www.mastercontrol.com/downloadables/customervideos/index.html?c=4http://www.mastercontrol.com/downloadables/customervideos/index.html?c=4http://www.mastercontrol.com/downloadables/customervideos/index.html?c=4http://www.mastercontrol.com/downloadables/customervideos/index.html?c=4


2/9

White Paper

tomating Document Control Processes

The purpose of document control systems is to ensure that manufacturers build products that are safe and reliable. ISO and

FDA Current Good Manufacturing Practices (CGMP) presume that both the process and documentation that directs company

processes follows pre-approved methods and that any change to these methods is restricted to authorized personnel and tracked

for future review. All FDA-regulated and ISO-certied companies are mandated to have a document change control system.

Inefcient document control systems cost FDA-regulated manufacturers millions of dollars. This signicant loss in revenue can

primarily be attributed to the inefciencies that occur when using a paper/hybrid-electronic system. (Wherein document change

control is managed in a manual fashion or using a combination of both paper and electronic les.) Manual systems are error-

prone, delay a products time to market, and introduce product quality problems that can result in stringent regulatory penalties.

In fact, the FDA cites inadequate change management as a major cause for Form 483 observations. Examples of common

shortcomings include documents with missing dates or missing numbering schemes, uncontrolled copies and document changes

without approvals or explanations. To eliminate these inadequacies, regulated companies are turning to electronic-based quality

management systems.

Todays quality management systems provide integrated solutions to handle everything from corrective /preventive actions

(CAPA) through change control and training. This article will focus on document control processes within the quality system

lifecycle and provide insight into the capabilities needed to automate change control processes that will increase efciency,

ensure compliance with FDA requirements and improve overall protability.

OVERVIEW

To eliminate the problems FDA-regulated companies are being cited for during inspections and audits, a change management /

change control software solution must incorporate the following capabilities:

Compliance Management

Document Management

Revision Control

Intuitive System Administration Tools

General Users/Viewer UsabilityOpen Architecture

Complete Implementation and Validation Tools

COMPLIANCE MANAGEMENT

In order to move from a manual, paper-based system to an electronic, automated system, manufacturers must follow the

guidelines outlined in regulation 21 CFR Part 11 for using electronic records and signatures. These guidelines include the

following:

Multi-password access and signatureforced expiration - The FDA requires two distinct identication

components for document compliant change control: one for login and one for document approval. Options should

be available for conguring the length of the password and alphanumeric combinations to maintain the highestlevel of security for the system. Password expiration, encryption and certication are also necessary.

Account and intruder lockout - An account should be automatically locked for both login and approval anytime

a password or login is compromised. If any unauthorized attempt is made during either login or approval, the

intruder lockout feature is activated (after the number of unauthorized login attempts or approval attempts has been

reached). The system administrator should be able to customize the number of password attempts.


3/9

White Paper


Figure 1 Change control as part of the quality management lifecycle

Signature manifestation on the document - Signature manifestations are required for FDA regulated companiesto meet Part 11 requirements and should be automatically appended to each document. Manifestations should

include rst name, last name, date, time and meaning of the electronic signature. Manifestations should also appear

on all human-readable forms that are either viewed electronically or printed on paper.

Change control rational - Changes made to document metadata should be tracked. (The Metadata contains

document attributes like title, author, etc.) Each time a change is made to any metadata, a user must enter a reason

for the change. The system must track each of these changes and make them available for review.

DOCUMENT MANAGEMENT

Document management capabilities boost efciency and ensure compliance by eliminating labor-intensive tasks like physically

routing documents for approval, storage and distribution.

Format agnostic - The system must be able to control any document regardless of the application used to create

(e.g, Word processing, spreadsheets, CAD, video, audio)

Document lifecycle management - Documents must be managed through their lifecycle statuses of Draft,

Released and Archived. (See Figure 2) Lifecycles can be based on document type and need to automatically adjust

document security based on lifecycle status.

Audit trail history / record archiving - A secure, time-stamped audit trail of all changes made to any record

should be maintained and accessible to the appropriate users and departments. All of this information needs to be

automatically captured and secured. Reporting functionality would track past versions, metadata and approval

history of the record, from the time it was created until the present.


4/9

White Paper


Centralized, Secure Repository - Documents should be securely stored to ensure only authorized access, while

making it easy to protect against disaster.

Document cross-linking - In manufacturing environments, documents complement one another. For example,

a form may be associated to a standard operating procedure (SOP), or an equipment manual associated with a

maintenance drawing, etc. A document control system should allow document linking to provide users the relevant

information needed to do their job.

REVISION CONTROL AUTOMATION

Document revision control represents one of the most time-consuming tasks and one of the tasks that is most ripe for

automation. When automating document control processes users will nd that with the right solution they can accomplish the

following:

Ensure control of all document versions/revisions - Be able to present the currently released document, while

simultaneously managing collaborative changes that will result in a new revision.

Control rogue documents - A system should alleviate the consequences of uncontrolled electronic documents by

enabling copies to Self Destruct after the congurable time allotted to the document expires. For example, a

document that is saved outside the system and e-mailed to another person would be impossible to open 48-hours

after it is copied from the system. Similarly, a system should offer capabilities to manage printed documents.

Anytime a document is printed from the system, expiration dates and times should be automatically watermarked

prominently on the document.

Automate document routing, approval and escalations - Document routing and approvals should be automated

to notify all approvers or collaborators in the authorization chain. Congurable, time-based escalation features

can expedite approval and collaboration cycles in case users are too slow to act or are unavailable. Upon approval,

old versions would automatically revision while users affected by the change are assigned a task be trained or re-

trained. (Training is addressed in a supplementary white paper available from MasterControl)

Automatic document replacement (draft to release to archive) - As documents are approved old versions should

automatically move to an archive vault and be replaced by the newest version. This eliminates any possibility of

employees using the incorrect version. (See Figure 2)

Unlimited pre-determined and ad-hoc routing steps - Routes for document collaboration or approval should

be pre-congurable for use at anytime or added on the y. Each step in a route can have one or many approvers

assigned to it to allow for the creation of a combination of serial and parallel routing.

Real-time,repeatablee-mailnotifcation - Customizable e-mail notication should be provided to alert users in

a route to take action of their specic tasks. Managers would be notied when tasks are completed to proactively

monitor collaboration, change management, approval and training cycles.

Electronic signature/approval history tracking - Managers should be able to view electronic signature details,

approval history and cycle statuses as needed during the change management process.

Automatic distribution upon approval - After the completion of approval cycles, documents should be

automatically distributed to users affected by the change and old versions are archived. (See Figure 2)


5/9

White Paper


Figure 2 - Document change control lifecycle

INTUITIVE SYSTEM ADMINISTRATION TOOLS

Easy to use system administration tools should be provided to comfortably manage the entire system:

Easy to use route builder capabilities with visual drag-and-drop interface - System administrators should be

able to easily build approval routes, thereby reducing the need for dedicated IT resources.

Confgurableuserrightsandroles - System administration tools to easily create a variety of individually tailored

user and security roles should exist. For example, some users may only need limited nd and view rights while

others may need broad edit privileges. Managing these roles when adding users and passwords for login or

electronic signatures within a centralized location improves usability and saves time.

Automated conversion/publishing to PDF - Optional document publishing to PDF throughout the document

lifecycle should be completely automated. PDF conversion from multiple document types into a common,

unalterable format helps improve efciency and reduce costs by eliminating additional desktop software that would

be required for users to view documents.

Advanced system reporting - A variety of standard and custom reports should be available like audit trail, master

list, cycle time and revision history to proactively manage the system to provide peace of mind with audit and

inspection preparedness.


6/9

White Paper


Figure 3 - Route Builder - What you see is what you get (WYSIWYG), drag and drop

GENERAL USER / VIEWER USABILITYA change control management system should provide users an intuitive interface to increase usability and system acceptance:

Browser-based / thin client access A browser-based system provides industry standard connectivity, ease of

use and company-wide access regardless of physical location. This helps connect remote employees, customers

and supply chain members into the change management loop. These members can participate in processes like

collaboration, document change, notication and training from any location.

Full-text /metadata searching Capabilities to search either the metadata or the full-text of all the documents

using any keyword or string of words should be available. Only a list of documents that both meet the search

criteria and match user security rights become accessible. Boolean and wildcard search operators should be

provided to narrow down search results.

Finding documents through graphically linked groupings - The system should offer users a graphical interface

to quickly nd the information required to do their job. Similar to a Windows or Macintosh desktop tree, users

should be able to point and click on folders that contain additional folders, projects and individual documents like

work instructions, procedures, etc. Documents must be able to reside in multiple trees, to facilitate different user

search logic, and automatically update upon revision to ensure that the most current document is always used.


7/9

White Paper


OPEN ARCHITECTURE

A change control system should provide system administrators a platform that is industry-proven and easy to deploy. Users

need a familiar and intuitive interface to increase usability and system acceptance.

Web-based - Internet-based systems provide users and IT managers alike a powerful, industry standard platform

offering pervasive access and ease of use. With web-based solutions, companies can leverage industry-standard

SSL and 128 bit encryption capabilities to secure the data communications that take place between the web browser

and application, while still gaining the benets of 24x7, anytime-anywhere access for authenticated users.

Integrate with other applications - Open system architectures, platforms and industry-common SQL database

technologies provide exible integration gateways to other quality system applications like CAPA, training, etc.

(See Figure 1) Integrating quality sub systems to work in tandem helps organizations leverage all the necessary

data and information to improve decision making that progress product quality, ensure compliance and increase

prots. Large corporate systems like MRP software can also be integrated to share information and data effected

by changes in procedures, drawings, bills of lading, etc.

Easy to use Graphical User Interface (GUI) An intuitive interface throughout the application allows system

administrators to easily build visual routes and manage the system for collaboration and change management

approval cycles. And, end users can quickly nd the information they need. An easy to use GUI is an important

ingredient for a successful implementation by improving overall system use and acceptance.

COMPLETE IMPLEMENTATION & VALIDATION TOOLS

FDA-regulated companies looking for document control, change management or change control systems should search out

applications that have complete services for implementation and validation.

Training for IT managers, system administrators and general users - A variety of training should be available

for system administrators, advanced users (PowerUsers) and general users (Viewers) that is mindful of the product,

the industry, and the customers unique practices. Such training should be available at the vendors facility, at thecustomer site, live over the Web, and/or

pre-recorded.

Validation tools and services - Organizations should ensure the solution provider has been audited by similar

companies within the appropriate industry and have a good user-base of references. Vendors should provide all the

necessary validation tools and services for buyers to either perform their own validation or elicit complete services

from the vendor. The vendors validation tools and services should follow Good Automated Manufacturing

Practice (GAMP) guidelines for computer systems validation. Vendors that offer their own validation tools and

services are more familiar with the system and can usually accelerate validation.

CONCLUSIONFDA-regulated companies would agree that moving from a manual, paper environment to an electronic system for document

control and change management is challenging. It is an endeavor that includes costs for upgrading IT infrastructures

(if necessary), the training of users and the validation of the system. However, most, if not all of the companies that have

made the transition can prove that the benets of automation include a faster return on investment (ROI). More importantly,

the automation of these change control tasks eliminate common errors that are cited in FDA 483 Observations yielded by

companies using manual, paper-based/hybrid-electronic systems.


8/9

White Paper


Related Videos

Reducing Risk with MasterControl

Using MasterControl for FDA Compliance

Using MasterControl for ISO Compliance

About MasterControl

MasterControl Inc. is a global provider of GxP process, quality audit, and document management software solutions for

life science companies. MasterControl products are easy to use, easy to deploy, easy to validate, and easy to maintain.

They incorporate industry best practices for automating and connecting every stage of the product development cycle, while

facilitating regulatory compliance. By combining an integrated platform with a continuum of risk-based software validation

products and services, MasterControl drives down the total cost of ownership and enables customers to extend their investmentacross the enterprise. Hundreds of companies, including 50 percent of the top 20 pharmaceutical enterprises, currently use

MasterControl solutions for easier compliance, faster validation, and better process management. For more information about

MasterControl, visit www.mastercontrol.com , or call 800-825-9117 (U.S.) or +44 (0) 1256 325 949 (Europe).

2008 MasterControl Inc. All rights reserved.
http://www.mastercontrol.com/downloadables/customervideos/index.html?c=22http://www.mastercontrol.com/downloadables/customervideos/index.html?c=12http://www.mastercontrol.com/downloadables/customervideos/index.html?c=11http://www.mastercontrol.com/http://www.mastercontrol.com/http://www.mastercontrol.com/downloadables/customervideos/index.html?c=11http://www.mastercontrol.com/downloadables/customervideos/index.html?c=12http://www.mastercontrol.com/downloadables/customervideos/index.html?c=22


9/9

MasterControl Inc.

Corporate Headquarters:

MasterControl Inc.6322 S. 3000 E. Ste. 110

Salt Lake City, UT 84121

United States

Phone: 800.825.9117

Fax: 801.942.7088

www.mastercontrol.com

Asian Headquarters:

MasterControl KK

Aios Akihabara 702

3-2-2 Ueno Taito-ku

Tokyo 110-0005

Japan

Phone: +81 (0) 3 6801 6147

Fax: +81 (0) 3 6801 6148

www.mastercontrol.com

European Headquarters:

MasterControl Global Limited

First Floor North Wing

Matrix HouseBasing View

Basingstoke

RG21 4FF

United Kingdom

Phone: +44 (0) 1256 325 949

Fax: +44 (0) 1256 325 289

www.mastercontrolglobal.co.uk

Germany Ofce

Mendelstrasse 11

48149 MuensterGermany

Phone: +49 (0) 251 980 2140

Fax: +49 (0) 251 980 2149

www.mastercontrolglobal.de

Email: [email protected]
http://www.mastercontrol.com/http://www.mastercontrol.com/http://www.mastercontrolglobal.co.uk/http://www.mastercontrolglobal.de/mailto:[email protected]:[email protected]://www.mastercontrolglobal.de/http://www.mastercontrolglobal.co.uk/http://www.mastercontrol.com/http://www.mastercontrol.com/